Analysis
-
max time kernel
20s -
max time network
124s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
26-07-2021 12:42
Behavioral task
behavioral1
Sample
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe
Resource
win10v20210410
General
-
Target
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe
-
Size
1.1MB
-
MD5
6b20ef8fb494cc6e455220356de298d0
-
SHA1
763d356d30e81d1cd15f6bc6a31f96181edb0b8f
-
SHA256
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d
-
SHA512
ef53b73a911a608439bf929fa66a66fbf015ed274735b91c1d3b08128b14d6514d5514157e541441b9de0827d068c8f514cfd24a3a52fecb2d09764c4fb3311a
Malware Config
Signatures
-
WastedLocker
Ransomware family seen in the wild since May 2020.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Diag:bin cryptone C:\Users\Admin\AppData\Roaming\Diag:bin cryptone C:\Windows\SysWOW64\Diag.exe cryptone C:\Windows\SysWOW64\Diag.exe cryptone -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
Diag:binDiag.exepid process 2696 Diag:bin 2076 Diag.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 2408 takeown.exe 3936 icacls.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 2408 takeown.exe 3936 icacls.exe -
Drops file in System32 directory 2 IoCs
Processes:
Diag:binattrib.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Diag.exe Diag:bin File opened for modification C:\Windows\SysWOW64\Diag.exe attrib.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3932 vssadmin.exe -
NTFS ADS 1 IoCs
Processes:
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Diag:bin 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3604 vssvc.exe Token: SeRestorePrivilege 3604 vssvc.exe Token: SeAuditPrivilege 3604 vssvc.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exeDiag:binDiag.execmd.execmd.execmd.exedescription pid process target process PID 512 wrote to memory of 2696 512 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe Diag:bin PID 512 wrote to memory of 2696 512 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe Diag:bin PID 512 wrote to memory of 2696 512 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe Diag:bin PID 2696 wrote to memory of 3932 2696 Diag:bin vssadmin.exe PID 2696 wrote to memory of 3932 2696 Diag:bin vssadmin.exe PID 2696 wrote to memory of 2408 2696 Diag:bin takeown.exe PID 2696 wrote to memory of 2408 2696 Diag:bin takeown.exe PID 2696 wrote to memory of 2408 2696 Diag:bin takeown.exe PID 2696 wrote to memory of 3936 2696 Diag:bin icacls.exe PID 2696 wrote to memory of 3936 2696 Diag:bin icacls.exe PID 2696 wrote to memory of 3936 2696 Diag:bin icacls.exe PID 2076 wrote to memory of 3296 2076 Diag.exe cmd.exe PID 2076 wrote to memory of 3296 2076 Diag.exe cmd.exe PID 2076 wrote to memory of 3296 2076 Diag.exe cmd.exe PID 3296 wrote to memory of 3504 3296 cmd.exe choice.exe PID 3296 wrote to memory of 3504 3296 cmd.exe choice.exe PID 3296 wrote to memory of 3504 3296 cmd.exe choice.exe PID 2696 wrote to memory of 3836 2696 Diag:bin cmd.exe PID 2696 wrote to memory of 3836 2696 Diag:bin cmd.exe PID 2696 wrote to memory of 3836 2696 Diag:bin cmd.exe PID 512 wrote to memory of 2408 512 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe cmd.exe PID 512 wrote to memory of 2408 512 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe cmd.exe PID 512 wrote to memory of 2408 512 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe cmd.exe PID 3836 wrote to memory of 2128 3836 cmd.exe choice.exe PID 3836 wrote to memory of 2128 3836 cmd.exe choice.exe PID 3836 wrote to memory of 2128 3836 cmd.exe choice.exe PID 2408 wrote to memory of 1932 2408 cmd.exe choice.exe PID 2408 wrote to memory of 1932 2408 cmd.exe choice.exe PID 2408 wrote to memory of 1932 2408 cmd.exe choice.exe PID 3296 wrote to memory of 2396 3296 cmd.exe attrib.exe PID 3296 wrote to memory of 2396 3296 cmd.exe attrib.exe PID 3296 wrote to memory of 2396 3296 cmd.exe attrib.exe PID 3836 wrote to memory of 2712 3836 cmd.exe attrib.exe PID 3836 wrote to memory of 2712 3836 cmd.exe attrib.exe PID 3836 wrote to memory of 2712 3836 cmd.exe attrib.exe PID 2408 wrote to memory of 188 2408 cmd.exe attrib.exe PID 2408 wrote to memory of 188 2408 cmd.exe attrib.exe PID 2408 wrote to memory of 188 2408 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 2396 attrib.exe 2712 attrib.exe 188 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe"C:\Users\Admin\AppData\Local\Temp\887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe"1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Diag:binC:\Users\Admin\AppData\Roaming\Diag:bin -r2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Diag.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Diag.exe /reset3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Diag" & del "C:\Users\Admin\AppData\Roaming\Diag"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\Diag"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe" & del "C:\Users\Admin\AppData\Local\Temp\887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Diag.exeC:\Windows\SysWOW64\Diag.exe -s1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Diag.exe" & del "C:\Windows\SysWOW64\Diag.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Diag.exe"3⤵
- Drops file in System32 directory
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Diag:binMD5
6b20ef8fb494cc6e455220356de298d0
SHA1763d356d30e81d1cd15f6bc6a31f96181edb0b8f
SHA256887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d
SHA512ef53b73a911a608439bf929fa66a66fbf015ed274735b91c1d3b08128b14d6514d5514157e541441b9de0827d068c8f514cfd24a3a52fecb2d09764c4fb3311a
-
C:\Users\Admin\AppData\Roaming\Diag:binMD5
6b20ef8fb494cc6e455220356de298d0
SHA1763d356d30e81d1cd15f6bc6a31f96181edb0b8f
SHA256887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d
SHA512ef53b73a911a608439bf929fa66a66fbf015ed274735b91c1d3b08128b14d6514d5514157e541441b9de0827d068c8f514cfd24a3a52fecb2d09764c4fb3311a
-
C:\Windows\SysWOW64\Diag.exeMD5
6b20ef8fb494cc6e455220356de298d0
SHA1763d356d30e81d1cd15f6bc6a31f96181edb0b8f
SHA256887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d
SHA512ef53b73a911a608439bf929fa66a66fbf015ed274735b91c1d3b08128b14d6514d5514157e541441b9de0827d068c8f514cfd24a3a52fecb2d09764c4fb3311a
-
C:\Windows\SysWOW64\Diag.exeMD5
6b20ef8fb494cc6e455220356de298d0
SHA1763d356d30e81d1cd15f6bc6a31f96181edb0b8f
SHA256887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d
SHA512ef53b73a911a608439bf929fa66a66fbf015ed274735b91c1d3b08128b14d6514d5514157e541441b9de0827d068c8f514cfd24a3a52fecb2d09764c4fb3311a
-
memory/188-136-0x0000000000000000-mapping.dmp
-
memory/512-115-0x0000000000400000-0x0000000000516000-memory.dmpFilesize
1.1MB
-
memory/512-114-0x0000000000580000-0x000000000062E000-memory.dmpFilesize
696KB
-
memory/1932-133-0x0000000000000000-mapping.dmp
-
memory/2076-126-0x0000000000DB0000-0x0000000000DC0000-memory.dmpFilesize
64KB
-
memory/2076-127-0x0000000000400000-0x0000000000516000-memory.dmpFilesize
1.1MB
-
memory/2128-132-0x0000000000000000-mapping.dmp
-
memory/2396-134-0x0000000000000000-mapping.dmp
-
memory/2408-131-0x0000000000000000-mapping.dmp
-
memory/2408-122-0x0000000000000000-mapping.dmp
-
memory/2696-120-0x0000000000520000-0x000000000066A000-memory.dmpFilesize
1.3MB
-
memory/2696-121-0x0000000000400000-0x0000000000516000-memory.dmpFilesize
1.1MB
-
memory/2696-116-0x0000000000000000-mapping.dmp
-
memory/2712-135-0x0000000000000000-mapping.dmp
-
memory/3296-128-0x0000000000000000-mapping.dmp
-
memory/3504-129-0x0000000000000000-mapping.dmp
-
memory/3836-130-0x0000000000000000-mapping.dmp
-
memory/3932-119-0x0000000000000000-mapping.dmp
-
memory/3936-124-0x0000000000000000-mapping.dmp